captcha
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill extracts and processes data from external websites to solve CAPTCHAs, creating an indirect prompt injection surface.\n
- Ingestion points: The skill ingests untrusted data from the page DOM (sitekeys and task descriptions) and captures screenshots of grid elements for vision analysis.\n
- Boundary markers: Absent. The task text and images extracted from external pages are interpolated directly into prompts for vision models or used as script arguments without delimiters or instructions to ignore embedded content.\n
- Capability inventory: The skill possesses capabilities for browser control (navigation, JS execution, clicking) via Playwright, network communication via standard libraries and SDKs, and local command execution via subprocess.run.\n
- Sanitization: Although json.dumps is used for injecting tokens into JavaScript, there is no validation or sanitization of the untrusted strings and images retrieved from external sites before they are used in prompts.\n- [EXTERNAL_DOWNLOADS]: The skill connects to third-party solving services and AI providers.\n
- Evidence: The scripts interact with well-known providers including 2captcha.com, api.capmonster.cloud, and api.anti-captcha.com, as well as the Anthropic and OpenAI APIs. These interactions are fundamental to the skill's primary function.\n- [COMMAND_EXECUTION]: The skill invokes local scripts to handle challenge solving.\n
- Evidence: Documentation and examples within the skill utilize subprocess.run to execute the bundled solve_captcha.py utility.
Audit Metadata